Skip to content

Commit

Permalink
Update fbjs to 1.0.0 to fix ReDos Vulnerability (#1978)
Browse files Browse the repository at this point in the history
Summary:
**Summary**
draft-js was using older version of fbjs that uses older version ua-parser-js what has a vulnerability.

https://app.snyk.io/vuln/npm:ua-parser-js:20180227

**Test Plan**

1. Run npm test and it passes
2. Run npm build and it passes
Pull Request resolved: facebookarchive/draft-js#1978

Differential Revision: D13746429

fbshipit-source-id: 636e9ad795f97781f6dc8a88125dcea0be005987
  • Loading branch information
Anthony Muscat authored and facebook-github-bot committed Jan 21, 2019
1 parent c9770e3 commit f7943c9
Show file tree
Hide file tree
Showing 5 changed files with 34 additions and 4 deletions.
2 changes: 1 addition & 1 deletion meta/bundle-size-stats/Draft.js.json

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion meta/bundle-size-stats/Draft.min.js.json

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion package.json
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
"test-ci": "cross-env NODE_ENV=test npm run lint && npm run flow && npm run test"
},
"dependencies": {
"fbjs": "^0.8.15",
"fbjs": "^1.0.0",
"immutable": "~3.7.4",
"object-assign": "^4.1.0"
},
Expand Down
5 changes: 5 additions & 0 deletions src/component/contents/DraftEditorContents-core.react.js
Original file line number Diff line number Diff line change
Expand Up @@ -197,6 +197,11 @@ class DraftEditorContents extends React.Component<Props> {
lastWrapperTemplate !== wrapperTemplate ||
currentDepth === null ||
depth > currentDepth;
/* $FlowFixMe(>=0.70.0 site=www) This comment suppresses an error found
* when Upgradng to FBJS 1.0.0 as the flow type for joinClasses is incorrect
* as it's joinClasses(className: mixed): string and it needs to be
* the correct type joinClasses(...className: Array<string>)
* run Flow. */
className = joinClasses(
className,
getListItemClasses(blockType, depth, shouldResetCount, direction),
Expand Down
27 changes: 26 additions & 1 deletion yarn.lock
Original file line number Diff line number Diff line change
Expand Up @@ -2476,6 +2476,11 @@ fb-watchman@^2.0.0:
dependencies:
bser "^2.0.0"

fbjs-css-vars@^1.0.0:
version "1.0.2"
resolved "https://registry.yarnpkg.com/fbjs-css-vars/-/fbjs-css-vars-1.0.2.tgz#216551136ae02fe255932c3ec8775f18e2c078b8"
integrity sha512-b2XGFAFdWZWg0phtAWLHCk836A1Xann+I+Dgd3Gk64MHKZO44FfoD1KxyvbSh0qZsIoXQGGlVztIY+oitJPpRQ==

fbjs-scripts@^0.8.0:
version "0.8.1"
resolved "https://registry.yarnpkg.com/fbjs-scripts/-/fbjs-scripts-0.8.1.tgz#c1c6efbecb7f008478468976b783880c2f669765"
Expand All @@ -2489,7 +2494,7 @@ fbjs-scripts@^0.8.0:
semver "^5.1.0"
through2 "^2.0.0"

fbjs@^0.8.15, fbjs@^0.8.16:
fbjs@^0.8.16:
version "0.8.16"
resolved "https://registry.yarnpkg.com/fbjs/-/fbjs-0.8.16.tgz#5e67432f550dc41b572bf55847b8aca64e5337db"
dependencies:
Expand All @@ -2501,6 +2506,20 @@ fbjs@^0.8.15, fbjs@^0.8.16:
setimmediate "^1.0.5"
ua-parser-js "^0.7.9"

fbjs@^1.0.0:
version "1.0.0"
resolved "https://registry.yarnpkg.com/fbjs/-/fbjs-1.0.0.tgz#52c215e0883a3c86af2a7a776ed51525ae8e0a5a"
integrity sha512-MUgcMEJaFhCaF1QtWGnmq9ZDRAzECTCRAF7O6UZIlAlkTs1SasiX9aP0Iw7wfD2mJ7wDTNfg2w7u5fSCwJk1OA==
dependencies:
core-js "^2.4.1"
fbjs-css-vars "^1.0.0"
isomorphic-fetch "^2.1.1"
loose-envify "^1.0.0"
object-assign "^4.1.0"
promise "^7.1.1"
setimmediate "^1.0.5"
ua-parser-js "^0.7.18"

figures@^2.0.0:
version "2.0.0"
resolved "https://registry.yarnpkg.com/figures/-/figures-2.0.0.tgz#3ab1a2d2a62c8bfb431a0c94cb797a2fce27c962"
Expand Down Expand Up @@ -2603,6 +2622,7 @@ flat-cache@^1.2.1:
flow-bin@^0.70.0:
version "0.70.0"
resolved "https://registry.yarnpkg.com/flow-bin/-/flow-bin-0.70.0.tgz#080ae83a997f2b4ddb3dc2649bf13336825292b5"
integrity sha1-CAroOpl/K03bPcJkm/EzNoJSkrU=

flush-write-stream@^1.0.0:
version "1.0.2"
Expand Down Expand Up @@ -6835,6 +6855,11 @@ typedarray@^0.0.6, typedarray@~0.0.5:
version "0.0.6"
resolved "https://registry.yarnpkg.com/typedarray/-/typedarray-0.0.6.tgz#867ac74e3864187b1d3d47d996a78ec5c8830777"

ua-parser-js@^0.7.18:
version "0.7.19"
resolved "https://registry.yarnpkg.com/ua-parser-js/-/ua-parser-js-0.7.19.tgz#94151be4c0a7fb1d001af7022fdaca4642659e4b"
integrity sha512-T3PVJ6uz8i0HzPxOF9SWzWAlfN/DavlpQqepn22xgve/5QecC+XMCAtmUNnY7C9StehaV6exjUCI801lOI7QlQ==

ua-parser-js@^0.7.9:
version "0.7.17"
resolved "https://registry.yarnpkg.com/ua-parser-js/-/ua-parser-js-0.7.17.tgz#e9ec5f9498b9ec910e7ae3ac626a805c4d09ecac"
Expand Down

0 comments on commit f7943c9

Please sign in to comment.